CVE-2023-34091
mediumpriority · track · 26EPSS 0.005 · 42 %ileEUUSEPSS · scored 2026-10-27
Kyverno is a policy engine designed for Kubernetes. In versions of Kyverno prior to 1.10.0, resources which have the `deletionTimestamp` field defined can bypass validate, generate, or mutate-existing policies, even in cases where the `validationFailureAction` field is set to `Enforce`. This situation occurs as resources pending deletion were being consciously exempted by Kyverno, as a way to reduce processing load as policies are typically not applied to objects which are being deleted. However, this could potentially result in allowing a malicious user to leverage the Kubernetes finalizers feature by setting a finalizer which causes the Kubernetes API server to set the `deletionTimestamp` and then not completing the delete operation as a way to explicitly to bypass a Kyverno policy. Note that this is not applicable to Kubernetes Pods but, as an example, a Kubernetes Service resource can be manipulated using an indefinite finalizer to bypass policies. This is resolved in Kyverno 1.10.0. There is no known workaround.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-hq4m-4948-64ccKyverno resource with a deletionTimestamp may allow policy circumvention2023-06-05ghsa · osvUS
### Impact In versions of Kyverno prior to 1.10.0, resources which have the `deletionTimestamp` field defined can bypass validate, generate, or mutate-existing policies, even in cases where the `validationFailureAction` field is set to `Enforce`. This situation occurs as resources pending deletion were being consciously exempted by Kyverno, as a way to reduce processing load as policies are typically not applied to objects which are being deleted. However, this could potentially result in allowing a malicious user to leverage the [Kubernetes finalizers feature](https://kubernetes.io/docs/concepts/overview/working-with-objects/finalizers/) by setting a finalizer which causes the Kubernetes API server to set the `deletionTimestamp` and then not completing the delete operation as a way to explicitly to bypass a Kyverno policy. Note that this is not applicable to Kubernetes Pods but, as an example, a Kubernetes Service resource can be manipulated using an indefinite finalizer to bypass policies. ### Patches This is resolved in Kyverno 1.10.0. ### Workarounds There is no known workaround. ### References _Are there any links users can visit to find out more?_
- GO-2023-1819Kyverno resource with a deletionTimestamp may allow policy circumvention in github.com/kyverno/kyverno2024-08-20vendor · osvUS
Kyverno resource with a deletionTimestamp may allow policy circumvention in github.com/kyverno/kyverno
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-34091/cnnvd
- https://github.com/kyverno/kyverno/releases/tag/v1.10.0cnnvd
- https://github.com/kyverno/kyverno/security/advisories/GHSA-hq4m-4948-64cccnnvd
- https://github.com/kyverno/kyverno/releases/tag/v1.10.0enisa_euvd
- https://github.com/kyverno/kyverno/security/advisories/GHSA-hq4m-4948-64ccenisa_euvd
- https://github.com/kyverno/kyverno/releases/tag/v1.10.0Release Notesnvd
- https://github.com/kyverno/kyverno/security/advisories/GHSA-hq4m-4948-64ccVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan